Problem - Kevin Tafuro

you might use a library such as OpenSSLor CryptoAPI that provides very narrow
choices. For this reason, the next several recipes provide implementations of MACs
we recommend for general-purpose use, particularly OMAC, CMAC, and HMAC.
Security Recommendations for MACs
MACs are not quite as low-level as cryptographic hash functions. Yet they are still
fairly low-level constructs, and there are some common pitfalls associated with them.
We discuss these elsewhere in the book, but here’s a summary of steps you should take
to defend yourself against common problems:
• Don’t use the same MAC key as an encryption key. If you’d like to have a system
with a single key, key your MAC and encryption separately, using the technique
from Recipe 4.11.
• Use a securely generated, randomly chosen key for your MAC, not something
hardcoded or otherwise predictable!
• Be sure to read Recipe 6.18 on how to use a MAC and encryption together
securely, as it can be difficult to do.
• Use an always-increasing nonce, and use this to actively thwart capture replay
attacks. Do this even if the MAC doesn’t have built-in support for nonces. (See
Recipe 6.21 for information on how to thwart capture replay attacks, and Recipe
6.12 for using a nonce with MACs that don’t have direct support for them.)
• It is of vital importance that any parties computing a MAC agree on exactly what
data is to be processed. To that end, it pays to get very detailed in specifying the
content of messages, including any fields you have and how they are encoded
before the MAC is computed. Any encoding should be unambiguous.
Some MAC interfaces may not remove key material from memory when done. Be
sure to check the particular implementation you’re using.
OpenSSLprovides only a single MAC implementation, HMAC, while CryptoAPI
supports both CBC-MAC and HMAC. Neither quite follows the API outlined in this
recipe, though they stray in different ways. OpenSSLperforms the reset operation
the same way as the initialization operation (you just pass in 0 in place of the key and
the algorithm arguments). CryptoAPI does not allow resetting the context object,
and instead requires that a completely new context object be created.
OMAC and HMAC do not take a nonce by default. See Recipe 6.12 to see how to
use these algorithms with a nonce. To see how to use the incremental HMAC interface
in OpenSSLand CryptoAPI, see Recipe 6.10. CryptoAPI does not have an all-inone
interface, but instead requires use of its incremental API.
Most libraries also provide an all-in-one interface to the MACs they provide. For
example, the HMAC all-in-one function for OpenSSL looks like this:
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Checking Message Integrity | 275